- Reliability 6/20
- The server claims to provide five generic tools (jira_get, jira_post, etc.), but the README provides no evidence of tests or CI configuration. It states use of MCP SDK v1.23.0 and Zod v4, but no source code or lockfile to verify. Thus, the happy path is plausible but untested for key paths, error handling and edge cases are thin. Static review caps at 6 - below 10 because no tests or CI evidence.
- Security and permissions 6/20
- The server uses user-provided API tokens via environment variables, no hardcoded credentials. However, the tool design allows arbitrary Jira API calls, including deletes (`jira_delete`), without confirmation or scoping. While data goes to Atlassian only, the least privilege is not respected. No malicious behavior found in static review, but lack of source and tests leaves security posture weak. Score 6.
- Maintenance 8/20
- Repository shows recent version (3.2.1), updates dependencies, and has published npm packages. However, no license or security response channel. Open issues exist but response status unknown. Overall active but governance/license gaps, so 8.
- Documentation 12/20
- README is extensive with install, auth, tool descriptions, examples, troubleshooting, and FAQ. It explains output format and truncation. However, it lacks detailed tool parameters and version compatibility, and no verifiable technical evidence (source/lockfile). Docs are usable but with hidden assumptions, so 12.
- Setup experience 8/20
- Setup is simple: set environment variables and use npx or npm install. Provides config example for Claude Desktop. Requires Node.js 18+ which is reasonable. No evidence of verification steps or cross-platform testing, and due to missing CI/tests, setup may be fragile. Score 8.